No Gambles with Information Security: The Victim Psychology of a Ransomware Attack

Ransomware is a cybercrime in which criminals must coerce their victims’ cooperation to profit from infections. There are generally three possible outcomes of a successful infection: (1) a user, having a secure recent backup of his data, will not feel compelled to pay; (2) an unprepared victim would rather accept the data loss than pay the ransom; and (3) the victim values the compromised data more than the ransom being asked, and therefore pays. Though such crimes are initiated by technological means, they rely on social persuasion for success. The argument will be put forward in this paper that ransomware attacks take advantage of the psychology of loss aversion, and that by delivering loss feedback, these attacks exert a psychological influence that is advantageous to the attackers, and which affects individuals differently according to their neural characteristics. Evidence from cognitive, personality and evolutionary psychology are each presented; directions for further research into the risk factors and mechanisms of persuasion in ransomware attacks are indicated.